Follow

logstash on Ubuntu seems to log in three places (I didn't set this up so I'm not positive what isn't default), which has caused one of our nodes to fill / because the ES instance it's writing to has some index issues.

Because anything worth logging once is worth logging three times!

I got to redirect syslog to our central log server (something we've been meaning to do anyway), remove a lot of files from /var/log/logstash, and then vacuum journalctl and tell it to retain only 500MB.

Sign in to participate in the conversation
Toot.Cat

The social network of the future: No ads, no corporate surveillance, ethical design, and decentralization! Own your data with Mastodon!